Go back to the Europarl portal

Choisissez la langue de votre document :

  • bg - български
  • es - español
  • cs - čeština
  • da - dansk
  • de - Deutsch
  • et - eesti keel
  • el - ελληνικά
  • en - English (Selected)
  • fr - français
  • ga - Gaeilge
  • hr - hrvatski
  • it - italiano
  • lv - latviešu valoda
  • lt - lietuvių kalba
  • hu - magyar
  • mt - Malti
  • nl - Nederlands
  • pl - polski
  • pt - português
  • ro - română
  • sk - slovenčina
  • sl - slovenščina
  • fi - suomi
  • sv - svenska
Parliamentary questions
PDF 28kWORD 22k
24 April 2019
Answer given by Ms Jourová on behalf of the European Commission
Question reference: E-000802/2019

The processing of personal data must rely on one of the six legal grounds laid down in the General Data Protection Regulation (GDPR)(1), consent only being one of them. Articles 4(11) and 7 GDPR pose specific conditions for consent to be valid, including that consent shall be freely given. Where the performance of a contract is being made conditional to providing consent to the processing of personal data which is not necessary for the performance of the contract, the consent provided by consumers will be presumed not to be freely given(2). The monitoring and enforcement of the application of GDPR is the competence of national supervisory authorities and courts.

The ePrivacy Directive(3) provides for rules on the protection of information in terminal equipment. If a device is connected to a public telecommunications network, the storing and accessing of information already stored in it requires the end-user’s consent, as defined in the GDPR, or it must be strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

According to EU consumer law(4) traders must inform consumers about the main characteristics of a product before a sales contract is concluded. Failing to inform a consumer that his or her personal data will be used for commercial purposes going beyond the transaction at hand(5) could be considered as a misleading practice. The seller may also be liable if the vacuum cleaner does not function as stipulated in the sales contract(6). Enforcement of consumer law is the responsibility of Member States’ courts and authorities. Consumers may request advice from their local European Consumer Centre(7), or seek a solution using the Online Dispute Resolution Platform(8).

(1)Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1‐88.
(2)European Data Protection Board guidelines on consent adopted on 10 April 2018, in particular pages 8-10, available at: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051
(3)Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37), amended by Directive 2009/136/EC. On 10 January 2017, the Commission adopted the proposal for a regulation on Privacy and Electronic Communications COM(2017) 010 final — 2017/03 (COD). The proposal includes a similar provision.
(4)Directive 2011/83/EU on consumer rights, OJ L 304, 22.11.2011, p. 64; Directive 2005/29/EC concerning unfair business-to-consumers commercial practices, OJ L 149, 11.6.2005, p. 22.
(5)Commission Staff Working Document — Guidance on the application/implementation of Directive 2005/29/EC on unfair commercial practices, SWD(2016)163 final of 25.5.2016, Section 3.4.1
(6)In accordance with Directive 1999/44/EC on certain aspects of the sale of consumer goods and associated guarantees, OJ L 171, 7.7.1999, p. 12.

Last updated: 25 April 2019Legal notice